52e674c0ebc9c303aea7f77e6f61b5389bc92005bb3450f9e262b4a5b655c087

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/04/2026, 17:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
QuickUpgrade.exe
Size 487KB
Sample260420-v2verac13x
SHA256 52e674c0ebc9c303aea7f77e6f61b5389bc92005bb3450f9e262b4a5b655c087
MD5 6f782f7c529b12940cc72d66607ac775
SHA1 29a677f8399ae2f7d7c653cf974bba1bf8adc827
SHA512 ea9a43082c558a141da1a9a0479c25a79e1b1cdab8efa85cc7943546a0d1116bd850873a0ee08ef7e23f2829c534340b8c27e7b964992311e07b89c201af1273
SSDEEP 3072:Uwlw46gYUBoWux28XvviXx/S0L4ab+cH6myRmrf/JnQwqdz4VSIxDdWk7HoZ7WKx:Uwlw4NXug8fvk60L4OqXcU6Y7WGya
TLSH
T1B5B47ED11ABA8CACE461CE7C8A91CCC9A5DF6D0C463D76BB0278341C5F7EBDA5864D20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
51	3432	QuickUpgrade.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Control Panel\International\Geo\Nation	QuickUpgrade.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Control Panel\International\Geo\Nation	pl4sfx.exe

Executes dropped EXE 5 IoCs

pid	Process
2812	pl4sfx.exe
4044	PostUpdate.exe
2772	bitsumsessionagent.exe
2900	processlasso.exe
3496	bitsumsessionagent.exe

Loads dropped DLL 6 IoCs

pid	Process
3432	QuickUpgrade.exe
3432	QuickUpgrade.exe
4044	PostUpdate.exe
4044	PostUpdate.exe
2900	processlasso.exe
2900	processlasso.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pl4sfx.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	PostUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	PostUpdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	processlasso.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	processlasso.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeAssignPrimaryTokenPrivilege	2900	processlasso.exe
Token: SeDebugPrivilege	2900	processlasso.exe
Token: SeChangeNotifyPrivilege	2900	processlasso.exe
Token: SeIncBasePriorityPrivilege	2900	processlasso.exe
Token: SeIncreaseQuotaPrivilege	2900	processlasso.exe
Token: SeCreateGlobalPrivilege	2900	processlasso.exe
Token: SeProfSingleProcessPrivilege	2900	processlasso.exe
Token: SeBackupPrivilege	2900	processlasso.exe
Token: SeRestorePrivilege	2900	processlasso.exe
Token: SeShutdownPrivilege	2900	processlasso.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3432 wrote to memory of 2812	3432	QuickUpgrade.exe	96
PID 2812 wrote to memory of 4044	2812	pl4sfx.exe	98
PID 4044 wrote to memory of 2900	4044	PostUpdate.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\QuickUpgrade.exe
"C:\Users\Admin\AppData\Local\Temp\QuickUpgrade.exe"
1⤵
- Downloads MZ/PE file
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3432
- C:\Users\Admin\AppData\Local\Temp\bitsum\processlasso\pl4sfx.exe
  "C:\Users\Admin\AppData\Local\Temp\bitsum\processlasso\pl4sfx.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2812
- - C:\Users\Admin\AppData\Local\Temp\PostUpdate.exe
    "C:\Users\Admin\AppData\Local\Temp\PostUpdate.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious use of WriteProcessMemory
    PID:4044
  - - C:\Users\Admin\AppData\Local\Temp\processlasso.exe
      /postupdate
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks processor information in registry
      Suspicious use of AdjustPrivilegeToken
      PID:2900

C:\Users\Admin\AppData\Local\Temp\bitsumsessionagent.exe
C:\Users\Admin\AppData\Local\Temp\bitsumsessionagent.exe ----------------------------------------------------------------
1⤵
- Executes dropped EXE
PID:2772

C:\Users\Admin\AppData\Local\Temp\bitsumsessionagent.exe
"C:\Users\Admin\AppData\Local\Temp\bitsumsessionagent.exe"
1⤵
- Executes dropped EXE
PID:3496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 734B
SHA256 2787067d45e7d1bfd4c464584bf72760dbe43cb8cb2d19a64b5045fba69679d1
MD5 417e1515abb2c4c688717634bf70377c
SHA1 b02330861433775b10e7ae74557911aa623c7fca
SHA512 e4105860e3acc34c85f95f58e5c4a2ca175161e01d5dbac5c6883b3ff165e4c66334618dad8dbda2470fe2438582a7b43c8020c686bdc364a05d7a1391d91e66
TLSH
T1890165E5F11C8404DDD749E0824DF64B5C6070687DF47C0A4143D06139587C5F25A578
MD5 SHA1 SHA512 TLSH

Submit Download

EEAEE06E692847928F75035DD1DB4862

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EEAEE06E692847928F75035DD1DB4862
Size 57KB
SHA256 53e1d6f670fca27f37cc521984d8547f9a14851f8fe8f92211dc0f39aa362395
MD5 e710cb088955a7273153309fa6dfacb7
SHA1 566bdd08d6768fb06f3d4ca886bc27b639f5c055
SHA512 b7fbf85cd05e4001f7b18a75f7baca1ff0abee1e546297cbd73165694b15c959262de47765ace4c5876fe9973bae19061692d6e3462fbfd32e11941cef31a956
SSDEEP 768:/aljVoA/E1vsBkVi6qKWC9FWuvSbIXubgrOsAaP50vH2GjvEct6Q5E27fE:a5p/E1kMiPnCIbInSYL25co78
TLSH
T19E433D685CB7F0619CAA5EA2BDDA9A9E56E491C52321031F1E70BF533CC3A9BCF53440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 85c30c701ed96a6c7fc4a183bc1066661ef6e80951d265a8c720388cb7e05533
MD5 3c1bb48955445beea0ff5890d17fc40a
SHA1 a162d5d6b696a8cbee2879cec72dfcedd0132b44
SHA512 aec1294a29128110452100c304526c32a127f929cb7443efb365190071464da05bb08fac77e08b32dfdaf62e53e0f44e06faea42f0fb019a9b2c8f6a21a5112f
TLSH
T135C02B0C0FDE0329F14403BB01708A021A10F404F28BFF0F1FB12A590566F329910CAE
MD5 SHA1 SHA512 TLSH

Submit Download

EEAEE06E692847928F75035DD1DB4862

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EEAEE06E692847928F75035DD1DB4862
Size 244B
SHA256 c0707ac9b2a324e9ccaab847dcbbb6cbbdfb6140e309ff0b95bb179c444dfe6a
MD5 866f18acdb43f5e377ebe39f2a3c7dcf
SHA1 5ba75b28a7493ae2e6fe87ea7c7e1698abc6a9fd
SHA512 beee96056d3febcfcb28bab9234e1d9ee994d68eb8983588b879c767b1354b0fbf0880d9d5e38d8a41669c276a3dec46f8d08025097669f3b064ddc13bbe6162
TLSH
T1BDD0133437550177E775C33655954D415E601183F8A18F5FD251065D9931F011CE580D
MD5 SHA1 SHA512 TLSH

Submit Download

PostUpdate.exe

Path C:\Users\Admin\AppData\Local\Temp\PostUpdate.exe
Size 721KB
SHA256 49a2ef480cf3280b2ba12b8d9495cb49bb62da4ede33825a249e3983784eff83
MD5 3eaea841a4d117e4dfc23767960db77b
SHA1 4f804f7e0152f048797ab306e39a785f0d0b0a66
SHA512 3a6ecf938a0f494ce0541f167ddb99ad8abdbb760a983a74cd18aef01d6e4b97afd439e24733a89ed13634f221912cf2ca4650d430e12f94438b3063c37874ce
SSDEEP 12288:vFJ42ruNtASVlCDdxdoAgWBghkpBUfQo2BKGbh:dJ4pNtASjC5xdoAgWShkpBUkDbh
TLSH
T185F491D055BA89ACD065CD7C8A92CC89B4EF7D0C473D79BB02B8386C4F3DB954A64E24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProcessLasso.exe

Path C:\Users\Admin\AppData\Local\Temp\ProcessLasso.exe
Size 2.3MB
SHA256 7a135a83c079c92c85a6ddb63425b2c0411958bc01a7b57593efe54ff14b92be
MD5 6f430ce9c9e72522d3dc3abac14b5fb5
SHA1 7f7044f3319d60d9d43c7abf0157d7d16e0bf9d2
SHA512 d8888c32c71dfe0d884decb36e202ea16d35f6f5ab8019109144dd3745e72a8a3cfe2779d3895c69113cd411b74ce3d740ce903e503f47204b40f95b10b8280b
SSDEEP 49152:OIFNK7mIX6oTWXepAKvB+YmUC7uk5hl6BWrtV+hO:1N6TIl7us+
TLSH
T13EB5489522A805A9E076C57C8986CC5BE9FB7C0C173979FB0160B9580F3FBE60A79F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QuickUpgrade.exe.Replacement

Path C:\Users\Admin\AppData\Local\Temp\QuickUpgrade.exe.Replacement
Size 487KB
SHA256 52e674c0ebc9c303aea7f77e6f61b5389bc92005bb3450f9e262b4a5b655c087
MD5 6f782f7c529b12940cc72d66607ac775
SHA1 29a677f8399ae2f7d7c653cf974bba1bf8adc827
SHA512 ea9a43082c558a141da1a9a0479c25a79e1b1cdab8efa85cc7943546a0d1116bd850873a0ee08ef7e23f2829c534340b8c27e7b964992311e07b89c201af1273
SSDEEP 3072:Uwlw46gYUBoWux28XvviXx/S0L4ab+cH6myRmrf/JnQwqdz4VSIxDdWk7HoZ7WKx:Uwlw4NXug8fvk60L4OqXcU6Y7WGya
TLSH
T1B5B47ED11ABA8CACE461CE7C8A91CCC9A5DF6D0C463D76BB0278341C5F7EBDA5864D20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pl4sfx.exe

Path C:\Users\Admin\AppData\Local\Temp\bitsum\processlasso\pl4sfx.exe
Size 3.1MB
SHA256 7b8e9ec084e4973d8e7e284695a542a8235ffe4f22e08fdf1239858d5ef38a80
MD5 daa140722cfa80047252d8f464b4c23c
SHA1 f75e6e4f03aebf7e82bbdaa2c9693668afd2bdd0
SHA512 16a13cfcdc16b78363360384e2ba292de7450a58da076297b13db16acdd1c7179e7c544020bd2202f2f4b52dbb26d413c34c18c47c50c4b6c8b2a641416f07df
SSDEEP 49152:9ILcrJFcstIv18GDwxrakyIlsybaUzEjq0+UFMH7CueujZ8ny631RqZqfLXx/Ra:9plFcstmTphIlZGUQqXHLZEx31Xd5
TLSH
T16FE52301BAC541B1D86328331A756F31E679BC205EF2CED743B82D5EB9362C06725BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bitsumsessionagent.exe

Path C:\Users\Admin\AppData\Local\Temp\bitsumsessionagent.exe
Size 180KB
SHA256 8f6507c3bb877e85d15adb5ed62d10cac19d32a8e7960e2116a21a6f9f242c11
MD5 c3781289e5ae15bc0e3bb0dbaeeb8cd6
SHA1 a7d26d8f39b43e036f19bafe62c1d4a17bd63bfc
SHA512 0be7b041c405c63f3ada0e525f6a1f0d1985ca0e7dff58f3d232962eaf41e1ce7b458ef2aed55e63cccc932df5f14fe1a4b69c2b55482e114c549b9d95abd7e1
SSDEEP 3072:eaNn5AwjVsJu3hE38kojLVJ6DIrVHnT5xx+Xe2:eaBWJuA2hnN+5
TLSH
T1B3046C5673E510F9E1778234C9A14A05F772B82207609BEF17B08376AF276D19E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pl_rsrc_temp.dll

Path C:\Users\Admin\AppData\Local\Temp\pl_rsrc_temp.dll
Size 1.9MB
SHA256 d050dcbc16be8ed00242576cfcb13a9aca1212693da369a895c41d4b6ad92783
MD5 5f1bcb904eaaf2c11a9c8df643dde78a
SHA1 dd8d1c141c4da0c45e5e300bcb1a8d42b54f1241
SHA512 0fcd292d2e0d1da564fe5a477504dcad6c11696c46b66293579874db9a20fefcd33f8d02c92df2353a002808a27f493a5eafd49aee816df833779ba60b65d30d
SSDEEP 6144:jfFa9MmhuV2FFdq7qFrwnim0gsZEeV3dyqlbWTjFC8fB4adLxp7WGCNE/Jt1icNa:jfcHoQuFzLXKGh4ZJe6cwTqREewWuQhe
TLSH
T1EB9582CE12BADC58F179EE781DA04E5818D73C8DE838B13D3A31711E997C6669828F53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2772-141-0x000002AEE0C80000-0x000002AEE0D1B000-memory.dmp

Download

memory/2900-142-0x000002760CC10000-0x000002760CCAB000-memory.dmp

Download

memory/3432-42-0x0000019083BA0000-0x0000019083C3B000-memory.dmp

Download

memory/3432-5-0x0000019083BA0000-0x0000019083C3B000-memory.dmp

Download

memory/3432-10-0x0000019088060000-0x000001908806C000-memory.dmp

Download

memory/3432-122-0x0000019088060000-0x000001908806C000-memory.dmp

Download

memory/3432-121-0x0000019083BA0000-0x0000019083C3B000-memory.dmp

Download

memory/3496-140-0x0000015D23210000-0x0000015D232AB000-memory.dmp

Download

memory/4044-134-0x000001567AEC0000-0x000001567AF5B000-memory.dmp

Download

memory/4044-135-0x000001567CD10000-0x000001567CD1C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads